CVE-2020-7389

🗓️ 22 Jul 2021 18:27:15Reported by rapid7Type

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 49 Views

Sage X3 System CHAINE Variable Script Command Injection. Authenticated user with developer access can pass OS commands

Reporter	Title	Published	Views	Family All 9
Information Security Automation	Last Week’s Security news: PrintNightmare patches and Metasploit, Kaseya CVEs, Morgan Stanley Accellion FTA, Cisco BPA and WSA, Philips Vue PACS, CISA RVAs, Lazarus job offers	11 Jul 202120:52	–	avleonov
CNNVD	Sage Group Sage X3 操作系统命令注入漏洞	22 Jul 202100:00	–	cnnvd
Cvelist	CVE-2020-7389 Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment	22 Jul 202118:27	–	cvelist
EUVD	EUVD-2020-28515	7 Oct 202500:30	–	euvd
NVD	CVE-2020-7389	22 Jul 202119:15	–	nvd
Prion	Command injection	22 Jul 202119:15	–	prion
Rapid7 Blog	CVE-2020-7387..7390: Multiple Sage X3 Vulnerabilities	7 Jul 202113:05	–	rapid7blog
The Hacker News	Critical Flaws Reported in Sage X3 Enterprise Management Software	8 Jul 202111:26	–	thn
ThreatPost	Critical Sage X3 RCE Bug Allows Full System Takeovers	7 Jul 202118:34	–	threatpost

NVD

Node

sage syracuseRange9.0–9.22.7.2

AND

sage x3Match9.0

Node

sage syracuseRange11.0–11.25.2.6

AND

sage x3Match11.0

Node

sage syracuseRange12.0–12.10.2.8

AND

sage x3Match12.0

[
  {
    "product": "X3",
    "vendor": "Sage",
    "versions": [
      {
        "lessThan": "Syracuse 9.22.7.2",
        "status": "affected",
        "version": "V9",
        "versionType": "custom"
      },
      {
        "lessThan": "Syracuse 11.25.2.6",
        "status": "affected",
        "version": "V11",
        "versionType": "custom"
      },
      {
        "lessThan": "Syracuse 12.10.2.8",
        "status": "affected",
        "version": "V12",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
rapid7	www.rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixed
rapid7	www.rapid7.com/blog/post/2021/07/07/cve-2020-7387-7390-multiple-sage-x3-vulnerabilities/

21 Nov 2024 05:37Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.15.5 - 7.2

CVSS 29

EPSS0.07132

cve-2020-7389 sage x3 chaine variable script command injection web application os commands